postiz-app
v2.26.0📨 The ultimate agentic social media scheduling tool 🤖
- Maintenance
- Active443 commits in 3 months · bus factor 1
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 23 advisories8 critical, 8 high, 7 medium
- Supported versions
- No scheduleendoflife.date does not track this project
41.6k stars · 8k forks · 213 open issues · last release 1 day ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 23 most recent advisories published by the maintainers: 8 critical, 8 high, 7 medium. Check the patched version against the one you run.
- criticalCVE-2026-115933Nov 2, 2026Forged signed tokens let any registered user take over other users and organizations
- Affected
- >= 2.15.0, < 2.25.3
- Patched in
- 2.25.3
- criticalCVE-2026-115932Nov 2, 2026Path traversal in post media lets any registered user read server files
- Affected
- >= 2.23.0, < 2.25.3
- Patched in
- 2.25.3
- criticalCVE-2026-115931Nov 2, 2026Arbitrary file read and backend crash through unrestricted provider method calls
- Affected
- >= 2.23.0, < 2.25.2
- Patched in
- 2.25.2
- mediumCVE-2026-107761Nov 2, 2026Channel tokens and organization API key exposed in API responses
- Affected
- >= 0, < 2.25.1
- Patched in
- 2.25.1
- highCVE-2026-94455Sep 22, 2026Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
- Affected
- >= 0, < 2.4.0
- Patched in
- 2.4.0
- criticalCVE-2026-94456Sep 22, 2026Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
- Affected
- >= 0, < 2.4.0
- Patched in
- 2.4.0
- criticalGHSA-4hgh-5rhf-4qpmAug 7, 2026Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
- Affected
- >= 0, < 2.22.1
- Patched in
- 2.22.1
- mediumCVE-2026-19127Aug 6, 2026Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
- Affected
- >= 0, < 2.21.10
- Patched in
- 2.21.10
- highCVE-2026-48799May 23, 2026Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
- Affected
- >= 0
- Patched in
- >= 2.21.8
- mediumCVE-2026-48783May 22, 2026Unauthenticated billing-enforcement bypass via /public/modify-subscription
- Affected
- >= 0
- Patched in
- >= 2.21.8
- criticalCVE-2026-48781May 22, 2026SUPERADMIN takeover via Skool-provider JWT forgery
- Affected
- >= 0
- Patched in
- >= 2.21.8
- mediumCVE-2026-42346Apr 28, 2026TOCTOU DNS rebinding bypasses all SSRF URL validation paths
- Affected
- >= 2.16.6
- mediumGHSA-jxg2-2cmf-h66mApr 28, 2026Password hash leaked in JWT token payload in Postiz
- Affected
- >= 2.21.16
- highCVE-2026-42556Apr 27, 2026Postiz stored XSS in public preview page
- Affected
- >= 2.21.6
- Patched in
- >= 2.21.7
- criticalCVE-2026-42298Apr 22, 2026Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
- Affected
- >= 0
- Patched in
- >= 0
- criticalCVE-2026-40487Apr 12, 2026Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS
- Affected
- >= 0
- Patched in
- >= 2.21.6
- highCVE-2026-40168Apr 9, 2026Server-Side Request Forgery via Redirect Bypass in /api/public/stream
- Affected
- >= 0
- Patched in
- >= 2.21.5
- mediumCVE-2026-34590Mar 29, 2026SSRF via Webhook Creation Endpoint Missing URL Safety Validation
- Affected
- >= 0
- Patched in
- >= 2.21.4
- mediumCVE-2026-34576Mar 29, 2026SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
- Affected
- >= 0
- Patched in
- >= 2.21.3
- highCVE-2026-34577Mar 29, 2026Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
- Affected
- >= 0
- Patched in
- >= 2.21.3
- highGHSA-89v5-38xr-9m4jMar 25, 2026Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)
- Affected
- >= 0
- Patched in
- >= 2.21.2
- highCVE-2024-34351Mar 25, 2026High-Severity SSRF in Postiz App
- Affected
- >= 0
- Patched in
- >= 2.21.1
- highCVE-2025-53641Jul 11, 2025Header mutation in middleware facilitates SSRF
- Affected
- >= 0
- Patched in
- >= 1.62.3